Security and Cryptography
MIT 6.NULL The Missing Semester of Your CS Education, lecture 9, explained in plain English
Want this lecture to stick? In LessonBound you get checked practice questions for every part, can ask about anything you don't get, and can listen with your screen off. Free, no ads.
Learn this lecture freeWatch or read the original lecture: MIT OpenCourseWare.
Part 1
This part explains the basic building blocks of cryptography: measuring password strength, hash functions, commitments, key derivation, and the two main kinds of encryption.
Key ideas
- Entropy measures how random a password is, and it is counted in bits. More bits means a password is harder to guess, and a password chosen at random from more possibilities has more entropy.
- A cryptographic hash function turns any input into a fixed-size fingerprint. The same input always gives the same fingerprint, and it is hard to work backward from the fingerprint to the input. SHA-1, used in Git, is no longer considered strong.
- A hash lets you commit to a value now and reveal it later. Others can check the revealed value against the hash you shared earlier, so you cannot secretly change it.
- Key derivation functions (KDFs) turn a passphrase into a fixed-length key. They are deliberately slow to make offline guessing attacks harder, and sites should store a salt with each password rather than the password itself.
- Symmetric cryptography uses one key to both lock and unlock data. Asymmetric cryptography uses a public key that anyone can share and a private key that you keep secret, and it can also be used to sign messages.
Words to know
- entropy
- A measure of how random something is. More entropy means it is harder for someone to guess.
- hash function
- A tool that turns any amount of data into a short, fixed-size fingerprint. The same input always gives the same fingerprint, and you cannot easily reverse it.
- key derivation function
- A tool that turns a passphrase into a key of a set length. It is built to be slow, so guessing passwords takes a long time.
- salt
- A random value added to a password before it is processed and stored. Each user gets their own salt, so stored values differ even when passwords match.
Example
Think of a hash like a fingerprint for a document. The same document always gives the same fingerprint, but you cannot rebuild the whole document from its fingerprint. If someone changes even one letter, the fingerprint changes, so you can check whether a file is the one you expected.
3 checked practice questions for this part are in the app.
Part 2
This part explains the everyday security tools that protect your passwords, your laptop data, your messages, and your logins, and the basic cryptography behind them.
Key ideas
- A password manager stores a unique, random, hard-to-guess password for each login in one encrypted place. You only need to remember one strong master passphrase.
- Two-factor authentication (2FA) asks for two things: something you know, like a passphrase, and something you have, like a YubiKey. This protects you even if someone steals your password or tricks you with a fake login page.
- Full disk encryption scrambles everything on your laptop's drive, and a passphrase unlocks it. If the laptop is stolen, the data stays unreadable.
- For private messages, the critical step is confirming that the public key belongs to the person you think it does. Signal and Keybase offer ways to do this.
- SSH keys work in two parts. Your public key sits on the server, and your private key stays encrypted on your computer. To log in, you prove you hold the private key by signing a random challenge from the server.
Words to know
- symmetric cipher
- A way to scramble data where the same secret key is used to lock and unlock it.
- key derivation function
- A tool that turns a passphrase you type into a strong, fixed-length key that can be used for encryption.
- asymmetric key pair
- Two linked keys: a public key you can share freely and a private key you keep secret. Anything locked with one can only be unlocked with the other.
- challenge-response
- A login method where the server sends a random number and the client proves its identity by signing it with its private key.
Example
Think of a password manager as one strong key to a safe. Inside the safe are all your other keys, each with a different lock. You only have to remember the one strong key, and a thief who finds one of your other keys can't open anything else.
3 checked practice questions for this part are in the app.
← Lecture 8: Metaprogramming · Lecture 10: Potpourri →
Notes written by AI (Claude) from the lecture's official transcript, so check anything important against the lecture. MIT CSAIL · CC BY-NC-SA 4.0 · not affiliated with or endorsed by MIT. These notes are shared under the same license.
LessonBound · Free lecture notes · Privacy · Terms · New York